sneakoscope 7.5.0 → 8.0.0

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 7.5.0** — its own identity, read from `package.json` and verified by the release gate, not advice about what to install.
+This README documents package **SKS 8.0.0** — its own identity, read from `package.json` and verified by the release gate, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. SKS stays version-agnostic: older hosts keep working where capabilities allow, while Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is actually supported — feature availability is decided by capability probes, not by a version number printed in a document. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it. Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph with evidence paths rather than lexical guessing — see [docs/architecture/context-graph.md](docs/architecture/context-graph.md) and [docs/architecture/search-engine-target.md](docs/architecture/search-engine-target.md). See [CHANGELOG.md](CHANGELOG.md).
 
@@ -63,13 +63,11 @@ The SKS menu bar shows the installed Codex CLI version and latest known version.
 
 **Manage MCP Servers…** opens a native macOS manager for the global `~/.codex/config.toml`. It can add remote URL or local stdio servers, enable/disable existing entries, remove entries after confirmation, and refresh the current state. Mutations are lock-protected, backed up, TOML-validated, and written with mode `0600`; configured environment values and command arguments are never rendered in the list. Changes apply to new Codex sessions. The same plumbing is available through the canonical `sks mcp config list|get|add|edit|duplicate|enable|disable|remove|test|login|logout|backups|restore` surface for diagnostics and automation.
 
-### Telegram remote coding on this Mac
+### Remote coding: Orca (external option)
 
-Open **SKS Center → Remote & Telegram**, create a bot with BotFather, send `/start` to that bot from the Telegram account you want to pair, then choose **Connect Bot & Register Coding Session…** and paste the token. SKS verifies the bot, stores the token only in macOS Keychain, pairs only that private chat/user, and registers one dedicated session bound to the current project. Choose **Start Hub**, then send ordinary text to the bot. On the first real message, the Hub creates the Codex thread and starts its first turn in the same App Server connection so the thread is durably resumable; later messages resume that exact thread and return the final response to Telegram.
+SKS no longer provides a first-party Telegram coding bridge. If you want to monitor or steer coding work from another device, consider [Orca](https://github.com/stablyai/orca), an external MIT-licensed project that can launch Codex in a worktree. Orca is not bundled with SKS, supported by SKS, or required to use SKS; SKS adds no Orca dependency or configuration.
 
-The Hub runs as a user LaunchAgent and uses `caffeinate -i` while the logged-in Mac is available. The Mac still needs to remain powered on, logged in, awake, and network-connected; closing the lid or logging out can stop access. Telegram input has no arbitrary shell path, runs with approvals disabled and network access disabled inside the Codex workspace sandbox, and cannot target an unpaired chat or another project.
-
-SKS Center is the menu bar companion: install it with `sks menubar install`, then click the SKS icon in the macOS menu bar and choose **Open SKS Control Center…**. Every GUI step above has a CLI equivalent (`sks telegram setup --bot-token-stdin`, `sks telegram hub start`, `sks telegram status`). The hub uses long polling, so a bot with an existing webhook must have that webhook removed before the hub can start; SKS fails closed with `telegram_webhook_conflict` and never clears it automatically. See **[docs/telegram-and-center.md](docs/telegram-and-center.md)** for the complete BotFather setup, optional command menu and privacy-mode guidance, secure token rotation, verification, and troubleshooting.
+Orca's mobile companion and Remote Orca Servers are beta. Their desktop/server runtime remains the source of truth and must keep running; remote access may require a private LAN or Tailscale path. See [the Orca migration and remote-coding guide](docs/orca-remote-coding.md) for scope, setup links, and former Telegram-user migration notes.
 
 ## The Front Door
 
@@ -241,16 +239,19 @@ It shows the current quickstart flow: one-line install, `$sks-plan`, `sks review
 - macOS optional: menu bar integration and `/usr/bin/open`
   - The menubar icon shows and hides itself automatically as the Codex desktop app launches/quits; set `quit_with_codex: true` in `~/.codex/sks-menubar/config.json` to have the menubar fully quit with Codex instead of just hiding (default `false`).
   - Native input dialogs (API keys, codex-lb setup) pass secrets to `sks` via `--api-key-stdin` instead of a visible Terminal window or process arguments.
-  - Auth/provider changes require a successful app restart; skipped or failed restarts fail the action.
-  - `sks update` preserves the selected codex-lb or ChatGPT OAuth mode, model, reasoning, catalog, and routing state.
-  - Providers exposes **Restore Chat / Pro (OAuth)** as an explicit auth-mode switch while retaining saved codex-lb credentials.
+  - Codex Desktop always keeps its real ChatGPT OAuth identity. codex-lb setup stores a separate gateway endpoint/key and never replaces `~/.codex/auth.json`.
+  - Providers separates **Desktop Full Capability**, **CLI Provider**, and **Capability Matrix**. Desktop Full Capability keeps the built-in OpenAI provider and routes supported traffic through a loopback bridge; CLI Provider is selected only for the CLI process.
+  - Authentication and routing modes do not toggle Codex App's native model picker, Fast, image, Browser Use, Computer Use, voice, plugins/apps, or other built-in surfaces. Capability status describes evidence for the codex-lb data path, not permission to use the native feature.
+  - `sks update`, setup, repair, and routing changes preserve OAuth, user model/reasoning/Fast settings, unknown catalog fields, and unrelated provider configuration. Legacy shared-auth routing requires explicit `sks codex-lb migrate-legacy-desktop --restart-app`; without a real restart and post-restart identity check it cannot finalize a migration receipt.
+  - The remote codex-lb service remains independently hosted and operated. SKS uses only the configured URL and gateway key; it does not deploy, restart, or change credentials on that host.
+  - Full release proof blocks with `real_required_missing` until fresh trust-anchored evidence covers the real Desktop feature/lifecycle matrix and the separately hosted other-Mac runtime; fixtures and configuration cannot satisfy that boundary.
   - Update installs always rebuild the companion with the newly installed SKS package, preventing a previous-version updater from restoring a stale menu binary.
   - The menubar dropdown's `View Last Log` item opens the most recent background action's log file, so you don't need to keep a Terminal window open to see command output.
   - `Manage MCP Servers…` provides a resizable native table and add/remove/enable/disable controls for global Codex MCP configuration. Secret environment values and command arguments are accepted through native dialogs/stdin but omitted from list output and logs.
   - `sks menubar status --json` reports a `codex_sync` object with `bundle_id`, `codex_running`, and `icon_visible_expected` to show Codex-lifecycle detection state.
   - The menu displays the installed Codex CLI version, adds an `⬆` status icon when `sks codex update-status` sees a newer release, runs the official self-updater through `Update Codex CLI Now`, and exposes `Run sks doctor --fix` as a background repair action.
-  - Fast mode has a verified status row and direct On/Off actions. Status failures render as unavailable with neither choice falsely selected.
-- If Codex shows `[No tool output found for custom tool call ...]`, SKS blocks reuse of that structurally ambiguous thread. Upgrade codex-lb (or explicitly run `sks codex-lb use-oauth`), inspect possible side effects, then continue the persisted mission in a fresh Codex task. SKS never rewrites session JSONL or fabricates a successful tool output.
+  - **Codex Fast** is labeled as the official 1.5× Codex speed option, with a verified service-tier status row and direct On/Off actions. Center explains that ChatGPT-sign-in GPT-5.6/GPT-5.5 use 2.5× Standard credits and GPT-5.4 uses 2×, while API-key token pricing and API Priority processing are separate. Model selection, Codex-Spark, and reasoning effort remain independent; status failures render as unavailable with neither choice falsely selected.
+- If Codex shows `[No tool output found for custom tool call ...]`, SKS blocks reuse of that structurally ambiguous thread. Upgrade codex-lb or run `sks codex-lb disable`, inspect possible side effects, then continue the persisted mission in a fresh Codex task. SKS never rewrites session JSONL or fabricates a successful tool output.
 - Zellij optional but recommended for terminal worker panes
 
 ## License

package/config/perf-budgets.v1.json

@@ -18,7 +18,6 @@
     { "id": "control_center_open", "budget_p95_ms": 400, "measured_runs": 5 },
     { "id": "mcp_static_list", "budget_p95_ms": 250, "measured_runs": 9 },
     { "id": "update_cache_read", "budget_p95_ms": 50, "measured_runs": 15 },
-    { "id": "telegram_callback_ack", "budget_p95_ms": 1000, "measured_runs": 7 },
     { "id": "ssh_worker_hello", "budget_p95_ms": 3000, "measured_runs": 5 }
   ]
 }

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "7.5.0"
+version = "8.0.0"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "7.5.0"
+version = "8.0.0"
 edition = "2021"
 
 [dependencies]

package/dist/cli/command-manifest-lite.js

@@ -37,7 +37,6 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'codex-lb', summary: 'Inspect codex-lb status and circuit health', maturity: 'beta', skipMigrationGate: true },
     { name: 'menubar', summary: 'Inspect/install/restart/uninstall SKS menu bar', maturity: 'beta', skipMigrationGate: true, allowedDuringActiveRoute: true, diagnostic: true },
     { name: 'remote', summary: 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', maturity: 'beta' },
-    { name: 'telegram', summary: 'Pair and run the private local Codex Telegram Hub', maturity: 'beta' },
     { name: 'hooks', summary: 'Explain and inspect Codex hooks', maturity: 'beta', skipMigrationGate: true },
     { name: 'zellij-lane', summary: 'Render a Zellij lane frame for SKS sessions', maturity: 'beta' },
     { name: 'zellij-slot-pane', summary: 'Render a compact Zellij worker slot pane', maturity: 'beta' },
@@ -73,6 +72,7 @@ const COMMAND_MANIFEST_LITE_BASE = [
     { name: 'versioning', summary: 'Manage release version metadata', maturity: 'stable' },
     { name: 'reasoning', summary: 'Show reasoning route', maturity: 'labs' },
     { name: 'aliases', summary: 'Show command aliases', maturity: 'stable' },
+    { name: 'align', summary: 'Prepare or inspect the evidence-gated $sks-align GPT-5.6 / Plugins modernization mission', maturity: 'beta', mutatesRouteState: true },
     { name: 'selftest', summary: 'Run local mock selftest', maturity: 'stable' },
     { name: 'goal', summary: 'Print stateless Codex native Goal controls', maturity: 'beta' },
     { name: 'seo-geo-optimizer', summary: 'Run unified SEO/GEO optimizer audit/plan/apply/verify plus research/strategy (--include-marketing) on the search-visibility kernel', maturity: 'beta' },
@@ -106,11 +106,11 @@ const SAFE_COMMAND_CONTRACT_LITE = {
     latency: 'normal',
     supportsJson: false,
     remoteAllowed: false,
-    telegramAllowed: false,
     inputProfile: 'none',
     requiredCapabilities: []
 };
 const COMMAND_CONTRACT_OVERRIDES_LITE = {
+    align: { latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     autoresearch: { latency: 'long' },
     bench: { latency: 'long' },
     check: { risk: 'R1', latency: 'long' },
@@ -120,8 +120,7 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
     'dollar-commands': { risk: 'R2', latency: 'normal' },
     eval: { latency: 'long' },
     gates: {
-        risk: 'R1', latency: 'long', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'gates', requiredCapabilities: ['project.git', 'proof.gates']
+        risk: 'R1', latency: 'long', supportsJson: true, remoteAllowed: true, inputProfile: 'gates', requiredCapabilities: ['project.git', 'proof.gates']
     },
     harness: { latency: 'long' },
     'image-ux-review': { latency: 'long' },
@@ -129,8 +128,7 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
     'mad-sks': { risk: 'R3', latency: 'long' },
     mcp: { risk: 'R2', latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     naruto: {
-        risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false,
-        inputProfile: 'naruto'
+        risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'naruto'
     },
     paths: {
         supportsJson: true, remoteAllowed: true, inputProfile: 'paths',
@@ -144,13 +142,12 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
     postinstall: { latency: 'long' },
     ppt: { latency: 'long' },
     proof: {
-        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'proof', requiredCapabilities: ['proof.read']
+        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'proof', requiredCapabilities: ['proof.read']
     },
     'qa-loop': { latency: 'long' },
     recallpulse: { latency: 'long' },
     release: { risk: 'R1', latency: 'long' },
-    remote: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false, inputProfile: 'json-only' },
+    remote: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     research: { latency: 'long' },
     review: { risk: 'R1' },
     run: { latency: 'long' },
@@ -160,18 +157,16 @@ const COMMAND_CONTRACT_OVERRIDES_LITE = {
         requiredCapabilities: ['project.fs.read']
     },
     status: {
-        supportsJson: true, remoteAllowed: true, telegramAllowed: true, inputProfile: 'json-only',
+        supportsJson: true, remoteAllowed: true, inputProfile: 'json-only',
         requiredCapabilities: ['proof.read']
     },
     'stop-gate': {
-        supportsJson: true, remoteAllowed: true, telegramAllowed: true, inputProfile: 'stop-gate',
+        supportsJson: true, remoteAllowed: true, inputProfile: 'stop-gate',
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
-    telegram: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false, inputProfile: 'json-only' },
     trust: {
-        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'trust', requiredCapabilities: ['proof.trust']
+        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },
     uninstall: { risk: 'R3', latency: 'long' },
     update: { latency: 'long' },

package/dist/cli/command-registry.js

@@ -4,7 +4,6 @@ const SAFE_COMMAND_CONTRACT = {
     latency: 'normal',
     supportsJson: false,
     remoteAllowed: false,
-    telegramAllowed: false,
     inputProfile: 'none',
     requiredCapabilities: []
 };
@@ -134,7 +133,6 @@ function applyCommandManifestContract(commands) {
             latency: manifest.latency,
             supportsJson: manifest.supportsJson,
             remoteAllowed: manifest.remoteAllowed,
-            telegramAllowed: manifest.telegramAllowed,
             inputProfile: manifest.inputProfile,
             requiredCapabilities: [...manifest.requiredCapabilities]
         });
@@ -187,7 +185,6 @@ const COMMAND_DEFINITIONS = {
     'codex-lb': skipMigrationGate(entry('beta', 'Inspect codex-lb status and circuit health', 'dist/commands/codex-lb.js', directCommand(() => import('../commands/codex-lb.js'), 'dist/commands/codex-lb.js'))),
     menubar: activeRouteDiagnostic(entry('beta', 'Inspect/install/restart/uninstall SKS menu bar', 'dist/core/commands/menubar-command.js', subcommand(() => import('../core/commands/menubar-command.js'), 'menubarCommand', 'dist/core/commands/menubar-command.js', 'status'))),
     remote: entry('beta', 'Inspect official Remote readiness and run the proof-aware SSH stdio worker', 'dist/core/commands/remote-command.js', argsCommand(() => import('../core/commands/remote-command.js'), 'remoteCommand', 'dist/core/commands/remote-command.js')),
-    telegram: entry('beta', 'Pair and run the private local Codex Telegram Hub', 'dist/core/commands/telegram-command.js', argsCommand(() => import('../core/commands/telegram-command.js'), 'telegramCommand', 'dist/core/commands/telegram-command.js')),
     hooks: skipMigrationGate(entry('beta', 'Explain and inspect Codex hooks', 'dist/commands/hooks.js', directCommand(() => import('../commands/hooks.js'), 'dist/commands/hooks.js'))),
     'zellij-lane': entry('beta', 'Render a Zellij lane frame for SKS sessions', 'dist/commands/zellij-lane.js', directCommand(() => import('../commands/zellij-lane.js'), 'dist/commands/zellij-lane.js')),
     'zellij-slot-pane': entry('beta', 'Render a compact Zellij worker slot pane', 'dist/commands/zellij-slot-pane.js', directCommand(() => import('../commands/zellij-slot-pane.js'), 'dist/commands/zellij-slot-pane.js')),
@@ -223,6 +220,7 @@ const COMMAND_DEFINITIONS = {
     versioning: entry('stable', 'Manage release version metadata', 'dist/commands/versioning.js', directCommand(() => import('../commands/versioning.js'), 'dist/commands/versioning.js')),
     reasoning: entry('labs', 'Show reasoning route', 'dist/core/commands/basic-cli.js', basicArgs('reasoningCommand')),
     aliases: entry('stable', 'Show command aliases', 'dist/core/commands/basic-cli.js', basicNoArgs('aliasesCommand')),
+    align: routeStateMutator(entry('beta', 'Prepare or inspect the evidence-gated $sks-align GPT-5.6 / Plugins modernization mission', 'dist/core/commands/align-command.js', subcommand(() => import('../core/commands/align-command.js'), 'alignCommand', 'dist/core/commands/align-command.js', 'prepare')), ['align-gate.json']),
     selftest: entry('stable', 'Run local mock selftest', 'dist/core/commands/basic-cli.js', basicArgs('selftestCommand')),
     goal: entry('beta', 'Print stateless Codex native Goal controls', 'dist/core/commands/goal-command.js', subcommand(() => import('../core/commands/goal-command.js'), 'goalCommand', 'dist/core/commands/goal-command.js')),
     'seo-geo-optimizer': entry('beta', 'Run unified SEO/GEO optimizer audit/plan/apply/verify plus research/strategy (--include-marketing) on the search-visibility kernel', 'dist/core/commands/seo-command.js', argsCommand(() => import('../core/commands/seo-command.js'), 'seoGeoOptimizerCommand', 'dist/core/commands/seo-command.js')),
@@ -256,6 +254,7 @@ const COMMAND_DEFINITIONS = {
     'agent-bridge': readOnly(entry('beta', 'Publish the agent-bridge manifest and print host registration snippets for external agent systems', 'dist/core/commands/agent-bridge-command.js', subcommand(() => import('../core/commands/agent-bridge-command.js'), 'agentBridgeCommand', 'dist/core/commands/agent-bridge-command.js', 'setup')))
 };
 const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(COMMAND_DEFINITIONS, {
+    align: { latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     autoresearch: { latency: 'long' },
     bench: { latency: 'long' },
     check: { risk: 'R1', latency: 'long' },
@@ -264,8 +263,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     dfix: { latency: 'long' },
     eval: { latency: 'long' },
     gates: {
-        risk: 'R1', latency: 'long', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'gates', requiredCapabilities: ['project.git', 'proof.gates']
+        risk: 'R1', latency: 'long', supportsJson: true, remoteAllowed: true, inputProfile: 'gates', requiredCapabilities: ['project.git', 'proof.gates']
     },
     harness: { latency: 'long' },
     'image-ux-review': { latency: 'long' },
@@ -273,8 +271,7 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     'mad-sks': { risk: 'R3', latency: 'long' },
     mcp: { risk: 'R2', latency: 'long', supportsJson: true, inputProfile: 'json-only' },
     naruto: {
-        risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false,
-        inputProfile: 'naruto'
+        risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'naruto'
     },
     paths: {
         supportsJson: true, remoteAllowed: true, inputProfile: 'paths',
@@ -288,13 +285,12 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
     postinstall: { latency: 'long' },
     ppt: { latency: 'long' },
     proof: {
-        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'proof', requiredCapabilities: ['proof.read']
+        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'proof', requiredCapabilities: ['proof.read']
     },
     'qa-loop': { latency: 'long' },
     recallpulse: { latency: 'long' },
     release: { risk: 'R1', latency: 'long' },
-    remote: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false, inputProfile: 'json-only' },
+    remote: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, inputProfile: 'json-only' },
     research: { latency: 'long' },
     review: { risk: 'R1' },
     run: { latency: 'long' },
@@ -303,18 +299,16 @@ const COMMANDS_WITH_LEGACY_CONTRACT_OVERRIDES = applyCommandContractOverrides(CO
         requiredCapabilities: ['project.fs.read']
     },
     status: {
-        supportsJson: true, remoteAllowed: true, telegramAllowed: true, inputProfile: 'json-only',
+        supportsJson: true, remoteAllowed: true, inputProfile: 'json-only',
         requiredCapabilities: ['proof.read']
     },
     'stop-gate': {
-        supportsJson: true, remoteAllowed: true, telegramAllowed: true, inputProfile: 'stop-gate',
+        supportsJson: true, remoteAllowed: true, inputProfile: 'stop-gate',
         requiredCapabilities: ['proof.stop-gate']
     },
     task: { risk: 'R1', latency: 'long' },
-    telegram: { risk: 'R2', latency: 'long', supportsJson: true, remoteAllowed: false, telegramAllowed: false, inputProfile: 'json-only' },
     trust: {
-        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, telegramAllowed: true,
-        inputProfile: 'trust', requiredCapabilities: ['proof.trust']
+        risk: 'R0', latency: 'fast', supportsJson: true, remoteAllowed: true, inputProfile: 'trust', requiredCapabilities: ['proof.trust']
     },
     uninstall: { risk: 'R3', latency: 'long' },
     update: { latency: 'long' },

package/dist/cli/install-helpers-codex-lb-chain.js

@@ -4,6 +4,7 @@ import fsp from 'node:fs/promises';
 import { ensureDir, packageRoot, readText, writeTextAtomic } from '../core/fsx.js';
 import { recordCodexLbHealthEvent } from '../core/codex-lb-circuit.js';
 import { codexLbBaseUrlSecurityBlocker } from '../core/codex-lb/codex-lb-env.js';
+import { probeEvidence } from '../core/codex-lb/probes/probe-evidence.js';
 import { CODEX_LB_CANONICAL_FAST_SERVICE_TIER, codexLbEnvPath, parseCodexLbEnvKey, redactSecretText } from './install-helpers-codex-lb-shared.js';
 function codexLbResponsesEndpoint(baseUrl = '') {
     const base = String(baseUrl || '').trim().replace(/\/+$/, '');
@@ -288,6 +289,47 @@ export async function checkCodexLbResponseChain(status = {}, opts = {}) {
         error: redactSecretText(second.error_payload?.error?.message || second.error_payload?.response?.error?.message || second.text || 'codex-lb chained Responses request failed', [apiKey])
     }, { endpoint, home, opts, env }), opts);
 }
+export async function runCodexLbTextResponsesProbe(status = {}, opts = {}) {
+    const result = await checkCodexLbResponseChain(status, opts);
+    return codexLbResponseChainCapabilityEvidence(result, {
+        checkedAt: typeof opts.nowIso === 'function' ? opts.nowIso() : new Date().toISOString()
+    });
+}
+export function codexLbResponseChainCapabilityEvidence(result = {}, opts = {}) {
+    const checkedAt = opts.checkedAt || new Date().toISOString();
+    if (result?.skipped === true || result?.status === 'skipped') {
+        return probeEvidence({
+            skipped: true,
+            source: 'config',
+            evidence: {
+                probe: 'text_responses',
+                status: result?.status || 'skipped',
+                reason: result?.reason || null
+            }
+        }, checkedAt);
+    }
+    const verified = result?.ok === true && result?.status === 'chain_ok';
+    const blockers = verified
+        ? []
+        : [
+            ...(Array.isArray(result?.blockers) ? result.blockers : []),
+            `text_responses_${String(result?.status || 'probe_failed')}`
+        ];
+    return probeEvidence({
+        attempted: true,
+        verified,
+        source: 'transport',
+        blockers,
+        evidence: {
+            probe: 'text_responses',
+            status: result?.status || null,
+            cached: result?.cached === true,
+            http_status: result?.http_status || null,
+            response_chain_completed: verified,
+            service_tier: result?.service_tier_evidence || null
+        }
+    }, checkedAt);
+}
 async function recordCodexLbChainHealth(result, opts = {}) {
     if (!result || result.skipped || opts.recordCircuit === false)
         return result;

package/dist/cli/install-helpers-codex-lb-config.js

@@ -4,24 +4,129 @@ import { ensureDir, readText } from '../core/fsx.js';
 import { GLM_CODEX_CONFIG_PROVIDER_ID, GLM_52_OPENROUTER_MODEL, OPENROUTER_AUTH_COMMAND, OPENROUTER_AUTH_REFRESH_INTERVAL_MS, OPENROUTER_AUTH_TIMEOUT_MS, openRouterAuthCommandArgs, OPENROUTER_DEFAULT_PROFILE_ID, RETIRED_GLM_DESKTOP_CONFIG_PROFILE_IDS } from '../core/codex-app/openrouter-provider.js';
 import { openRouterSecretPaths, resolveOpenRouterApiKey } from '../core/providers/openrouter/openrouter-secret-store.js';
 import { reconcileRetiredSksConfigText } from '../core/auto-review.js';
-import { removeTopLevelTomlKeyIfValue, safeWriteCodexConfigToml, upsertTopLevelTomlString, upsertTomlTable } from '../core/codex-runtime/codex-desktop-config-policy.js';
+import { ensureTrailingNewline, removeTopLevelTomlKeyIfValue, safeWriteCodexConfigToml, upsertTopLevelTomlString, upsertTomlTable } from '../core/codex-runtime/codex-desktop-config-policy.js';
 import { codexLbConfigPath, normalizeCodexLbBaseUrl } from './install-helpers-codex-lb-shared.js';
 import { escapeRegExp } from '../core/text/regex.js';
-export function upsertCodexLbConfig(text = '', baseUrl, selectDefault = true) {
-    let next = selectDefault
+export const CODEX_LB_DESKTOP_BRIDGE_MARKER = '# sks-codex-lb-managed-desktop-bridge';
+export const CODEX_LB_DESKTOP_COMPAT_MARKER = '# sks-codex-lb-managed-desktop-compat';
+export const CODEX_LB_MODEL_CATALOG_MARKER = '# sks-codex-lb-managed-model-catalog';
+const LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
+export function upsertCodexLbNativeDesktopConfig(text, input) {
+    let next = String(text || '');
+    const selectedProvider = topLevelTomlString(next, 'model_provider');
+    if (selectedProvider && selectedProvider !== 'openai' && selectedProvider !== 'codex-lb') {
+        throw new Error('codex_lb_user_owned_model_provider_conflict');
+    }
+    if (selectedProvider === 'codex-lb' && !topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)) {
+        throw new Error('codex_lb_legacy_desktop_config_requires_migration');
+    }
+    if (topLevelHasLine(next, LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER)
+        && !topLevelHasLine(next, CODEX_LB_DESKTOP_BRIDGE_MARKER)) {
+        throw new Error('codex_lb_legacy_desktop_config_requires_migration');
+    }
+    const modelCatalog = topLevelTomlString(next, 'model_catalog_json');
+    if (modelCatalog && !topLevelHasLine(next, CODEX_LB_MODEL_CATALOG_MARKER)) {
+        throw new Error('codex_lb_user_owned_model_catalog_json_conflict');
+    }
+    next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
+    next = removeTopLevelLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER);
+    next = removeManagedModelCatalogJson(next);
+    next = upsertManagedTopLevelTomlString(next, 'openai_base_url', input.bridgeBaseUrl, CODEX_LB_DESKTOP_BRIDGE_MARKER);
+    next = upsertTomlTable(next, 'model_providers.codex-lb', cliProviderBlock(input.remoteBaseUrl));
+    return ensureTrailingNewline(next);
+}
+export function upsertCodexLbCompatDesktopConfig(text, input) {
+    let next = removeManagedDesktopBridgeRouting(String(text || ''));
+    next = removeManagedModelCatalogJson(next);
+    next = upsertManagedTopLevelTomlString(next, 'model_provider', 'codex-lb', CODEX_LB_DESKTOP_COMPAT_MARKER);
+    const block = [
+        '[model_providers.codex-lb]',
+        'name = "OpenAI"',
+        `base_url = ${JSON.stringify(input.remoteBaseUrl)}`,
+        'wire_api = "responses"',
+        'requires_openai_auth = true',
+        'supports_websockets = true',
+        'env_http_headers = { "X-Codex-LB-API-Key" = "CODEX_LB_API_KEY" }'
+    ].join('\n');
+    next = upsertTomlTable(next, 'model_providers.codex-lb', block);
+    return ensureTrailingNewline(next);
+}
+export function upsertCodexLbCliProviderConfig(text, input) {
+    let next = input.selectGlobally === true
         ? upsertTopLevelTomlString(text, 'model_provider', 'codex-lb')
         : removeTopLevelTomlKeyIfValue(text, 'model_provider', 'codex-lb');
-    const block = [
+    next = upsertTomlTable(next, 'model_providers.codex-lb', cliProviderBlock(input.remoteBaseUrl));
+    return ensureTrailingNewline(next);
+}
+export function removeCodexLbManagedDesktopConfig(text) {
+    let next = removeManagedDesktopBridgeRouting(String(text || ''));
+    if (topLevelHasLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER)) {
+        next = removeTopLevelTomlKeyIfValue(next, 'model_provider', 'codex-lb');
+        next = removeTopLevelLine(next, CODEX_LB_DESKTOP_COMPAT_MARKER);
+    }
+    next = removeManagedModelCatalogJson(next);
+    return ensureTrailingNewline(next);
+}
+export function removeManagedModelCatalogJson(text) {
+    if (!topLevelHasLine(text, CODEX_LB_MODEL_CATALOG_MARKER))
+        return text;
+    const withoutKey = removeTopLevelTomlKey(text, 'model_catalog_json');
+    return removeTopLevelLine(withoutKey, CODEX_LB_MODEL_CATALOG_MARKER);
+}
+export function removeManagedDesktopBridgeRouting(text) {
+    const markers = [
+        CODEX_LB_DESKTOP_BRIDGE_MARKER,
+        LEGACY_CODEX_LB_OPENAI_ROUTING_MARKER
+    ].filter((marker) => topLevelHasLine(text, marker));
+    if (markers.length === 0)
+        return text;
+    let next = removeTopLevelTomlKey(text, 'openai_base_url');
+    for (const marker of markers)
+        next = removeTopLevelLine(next, marker);
+    return next;
+}
+export function upsertCodexLbConfig(text = '', baseUrl, selectDefault = true) {
+    return upsertCodexLbCliProviderConfig(text, {
+        remoteBaseUrl: String(baseUrl || ''),
+        selectGlobally: selectDefault === true
+    });
+}
+function cliProviderBlock(remoteBaseUrl) {
+    return [
         '[model_providers.codex-lb]',
-        'name = "openai"',
-        `base_url = "${baseUrl}"`,
+        'name = "codex-lb"',
+        `base_url = ${JSON.stringify(remoteBaseUrl)}`,
         'wire_api = "responses"',
         'env_key = "CODEX_LB_API_KEY"',
         'supports_websockets = true',
-        'requires_openai_auth = true'
+        'requires_openai_auth = false'
     ].join('\n');
-    next = upsertTomlTable(next, 'model_providers.codex-lb', block);
-    return `${next.trim()}\n`;
+}
+function upsertManagedTopLevelTomlString(text, key, value, marker, legacyMarkers = []) {
+    const acceptedMarkers = [marker, ...legacyMarkers];
+    const existing = topLevelTomlString(text, key);
+    const ownedMarker = acceptedMarkers.find((candidate) => topLevelHasLine(text, candidate));
+    if (existing && !ownedMarker) {
+        if (existing === value)
+            return text;
+        throw new Error(`codex_lb_user_owned_${key}_conflict`);
+    }
+    let next = text;
+    for (const candidate of acceptedMarkers)
+        next = removeTopLevelLine(next, candidate);
+    next = upsertTopLevelTomlString(next, key, value);
+    return addTopLevelMarkerBeforeKey(next, key, marker);
+}
+function removeTopLevelTomlKey(text, key) {
+    const lines = String(text || '').split('\n');
+    const firstTable = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
+    const end = firstTable === -1 ? lines.length : firstTable;
+    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    return lines
+        .filter((line, index) => index >= end || !keyPattern.test(line))
+        .join('\n')
+        .replace(/^\n+/, '')
+        .replace(/\n{3,}/g, '\n\n');
 }
 const CODEX_LB_SHARED_OPENAI_ROUTING_MARKER = '# sks-codex-lb-managed-openai-base-url';
 export function codexLbSharedOpenAiRoutingState(text = '', baseUrl = '') {